Security questionnaires and SOC 2: what bigger clients will ask you

At some point, a larger client will send you a spreadsheet with a hundred or more security questions and a note saying procurement needs it back before they can sign. Or they'll ask, "Do you have a SOC 2?" This usually happens just as a deal is getting exciting, and it can feel like a wall.

It doesn't have to be. This guide explains what's being asked, what SOC 2 actually is, and how to respond well without overpromising.

Why clients ask

Your client is responsible for their data, including the parts they share with you. Their regulators, insurers, auditors, and own customers expect them to check their vendors. You're now on their vendor risk list, the same way your software providers are on yours.

What a questionnaire covers

Questionnaires vary, but most cover the same ground:

Governance: Do you have a written security policy? Who is responsible for security? Do staff complete training?
Access control: Is two-factor authentication required? Do you use single sign-on? How do you remove access when people leave?
Devices: Are laptops encrypted and centrally managed? Is antivirus or endpoint protection in place?
Data: Where will our data be stored? Is it encrypted? How long do you keep it? How do you delete it?
Vendors: Which subprocessors will touch our data? How do you assess them?
Incidents: Do you have an incident response plan? How fast will you notify us?
Continuity: Do you back up data and test restores? Do you have a disaster recovery plan?
Assurance: Do you have SOC 2, ISO/IEC 27001, or a recent penetration test?

You may see standard formats with names like the SIG (from Shared Assessments), the CAIQ (from the Cloud Security Alliance), or HECVAT (used in higher education). Many companies also write their own.

How to answer well

Read the whole thing first. Note which questions apply to the service you're actually providing. If you never store their data, say so clearly; many sections then become "not applicable," with an explanation.

Answer honestly. "No" or "Partially, here's what we do instead" is acceptable. A false "yes" isn't, and it may end up in your contract as a promise.

Explain compensating controls. If you don't have a dedicated security team, say who owns security and what outside help you use. If you don't have SOC 2, describe the controls you do have and offer evidence.

Attach evidence. Your security policy, a summary of your incident response plan, your vendor list, and screenshots of key settings (for example, two-factor enforcement in your admin console) carry more weight than words.

Save your answers. Build an answer library. The next questionnaire will ask many of the same questions in different words.

Offer a call. A 30-minute call with the client's security reviewer often resolves questions faster than another round of spreadsheets.

Watch what ends up in the contract

Questionnaire answers, and security terms in the contract, can become obligations. Read the security schedule or addendum carefully, especially notification deadlines, audit rights, and insurance requirements. If anything is unclear, ask a lawyer before you sign.

SOC 2, explained accurately

SOC 2 is a type of report defined by the AICPA (the American Institute of Certified Public Accountants). An independent CPA firm examines a service organization's controls and issues an attestation report with its opinion. It's widely requested in the US, especially for software and service providers that handle client data.

Key points that are often misunderstood:

It's an attestation, not a certification. There's no "SOC 2 certified" badge. You receive a report with an auditor's opinion.
It's based on the Trust Services Criteria. These cover five categories: Security, Availability, Processing Integrity, Confidentiality, and Privacy. Security is always included. The others are added if they're relevant to the services you promise.
You define your controls. SOC 2 doesn't hand you a fixed checklist. You describe your system and controls, and the auditor tests them against the criteria.
The report is restricted. SOC 2 reports are usually shared with clients and prospects under a non-disclosure agreement, not published. A separate SOC 3 report is a shorter, general-use version you can share publicly.

Type I versus Type II

	Type I	Type II
What it looks at	Whether your controls are suitably designed (and in place) at a specific point in time	Whether your controls are suitably designed and operated effectively over a period of time
Period	A single date	A review period, commonly somewhere between several months and a year
What clients think of it	A useful first step	What most larger clients ultimately want

Many companies get a Type I first to show progress, then move to Type II. Some go straight to Type II.

What it takes

Getting a SOC 2 report means choosing a CPA firm, deciding the scope, putting controls in place and documenting them, often doing a readiness assessment, then the audit itself. Compliance automation platforms can help collect evidence. Costs and timelines vary a lot depending on your size, scope, and starting point, so get quotes rather than relying on general figures.

SOC 2 or ISO 27001?

ISO/IEC 27001 is an international standard for an information security management system. Unlike SOC 2, it is a certification, issued by an accredited certification body. It's more common outside the US. Ask your clients which they prefer before choosing.

	SOC 2	ISO/IEC 27001
What it is	An attestation report with an auditor's opinion	A certification
Who issues it	An independent CPA firm, under AICPA rules	An accredited certification body
Where it's common	Widely requested in the US	More common outside the US

When to pursue SOC 2

Good signals that it's time:

Several prospects in a row ask for it, and you're losing or delaying deals without it
A key client makes it a contract requirement
You're selling into regulated industries (finance, healthcare, enterprise software)

Until then, a clear policy, honest questionnaire answers, and solid evidence will often be enough.

Frequently asked questions

Can we ask to see a vendor's SOC 2 when they ask for ours?

Yes, and you should for vendors that hold your clients' data. Ask for their report and a bridge letter if the report period ended a while ago. A bridge letter is the vendor's own statement about the gap between the end of the report period and today.

Our software vendors have SOC 2. Does that cover us?

It covers their systems, not yours. You can point to it for the parts they handle (for example, "client data is hosted on X, which holds a SOC 2 Type II report"), but your own controls still need describing.

How long does a questionnaire take?

The first one takes the longest. With a saved answer library and a written policy, later ones get much faster.